Presentation of network source and executable characteristics

• US 7,640,590 B1
• Filed: 12/21/2004
• Issued: 12/29/2009
• Est. Priority Date: 12/21/2004
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Sobel, William E., McCorkendale, Bruce
• Primary Examiner(s): Shiferaw; Eleni A
• Application Number:
  US11/020,514
• Time in Patent Office: 1,834 Days
• Field of Search: 726 22- 25, 713/188
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A risk assessment module identifies information regarding a source. The risk assessment module submits the identified information regarding the source to a server. A compilation module of the server accesses one or more services to determine one or more characteristics of the source. The compilation module provides the determined one or more characteristics of the source to the client. A presentation module of the client presents the one or more characteristics of the source to a user.

Claims

1. A method of informing a user of a computer system of a potential threat, comprising:

using the computer system to perform steps comprising;

identifying information regarding a source of a communication;

determining a characteristic of the source based on the identified information regarding the source, wherein the determined characteristic comprises a reputation of the source and whether the source is a well-established entity;

determining a score representing a threat assessment for the source responsive to the determined characteristic; and

graphically presenting a representation of the score representing the threat assessment for the source to the user in association with the communication, wherein the representation comprises an icon indicating the reputation of the source and whether the source is a well-established entity, and wherein the icon is graphically presented in association with a program executing on the computer system and rendering the communication.

2. The method of claim 1, further comprising:

parsing the communication from the source to identify a link included in the communication;

identifying information regarding the link'"'"'s source;

determining a characteristic of the link'"'"'s source based on the identified information regarding the link'"'"'s source; and

graphically presenting a representation of the determined characteristic of the link'"'"'s source to the user in association with the communication.

3. The method of claim 1, wherein the source is executable code stored locally in the computer system.

4. The method of claim 1, wherein determining the characteristic of the source comprises:

communicating the identified information regarding the source to a server; and

receiving the characteristic of the source from the server.

5. The method of claim 1, wherein determining the characteristic of the source comprises:

determining the characteristic of the source based on information stored in a local memory area.

6. The method of claim 1, further comprising:

storing the determined characteristic of the source in a local memory area.

7. The method of claim 1, further comprising:

presenting the determined characteristic of the source to the user via an audible cue.

8. The method of claim 1, wherein the determined characteristic comprises a risk that the source is malicious.

9. The method of claim 1, further comprising:

determining a plurality of characteristics of the source based on the identified information regarding the source,

wherein the graphically presenting presents a representation of the plurality of determined characteristics of the source in association with the communication.

10. The method of claim 9, wherein the icon indicates the plurality of determined characteristics of the source.

11. The method of claim 9, further comprising:

determining a score representing a threat assessment for the source responsive to the plurality of determined characteristics.

12. The method of claim 1, wherein the determined characteristic comprises whether the source is using a dialup or cable modem and the icon indicates whether the source is using a dialup or cable modem.

13. The method of claim 1, wherein the determined characteristic comprises a country where the source is physically located and the icon indicates the country.

14. The method of claim 1, wherein the determined characteristic comprises whether the source is known to have been compromised by a fraudulent party and the icon indicates whether the source has been compromised.

15. The method of claim 1, wherein the graphically presenting further comprises:

modifying a rendering of the communication to graphically indicate the determined characteristic of the source.

16. A system for informing a user of a computer system of a potential threat, comprising:

a computer-readable storage medium storing executable program code, the program code comprising;

a risk assessment module for identifying information regarding a source of a communication;

a local logic module for determining a characteristic of the source based on the identified information regarding the source and determining a score representing a threat assessment for the source responsive to the determined characteristic, wherein the determined characteristic comprises a reputation of the source and whether the source is a well-established entity; and

a presentation module for graphically presenting a representation of the score representing the threat assessment for the source to the user in association with the communication, wherein the representation comprises an icon indicating the reputation of the source and whether the source is a well-established entity, and wherein the icon is graphically presented in association with a program executing on the computer system and rendering the communication.

17. The system of claim 16,

wherein the risk assessment module is adapted to parse the communication from the source to identify a link included in the communication and to identify information regarding the link'"'"'s source;

wherein the local logic module is adapted to determine a characteristic of the link'"'"'s source based on the identified information regarding the link'"'"'s source; and

wherein the presentation module is adapted to graphically present a representation of the determined characteristic of the link'"'"'s source to the user in association with the communication.

18. The system of claim 16, wherein the source is executable code stored locally in the computer system.

19. The system of claim 16, wherein the risk assessment module is adapted to:

communicate the identified information regarding the source to a server; and

receive the characteristic of the source from the server.

20. The system of claim 16, further comprising:

a cache module for storing characteristic information of one or more sources; and

wherein the local logic module is adapted to determine the characteristic of the source based on the characteristic information stored in the cache module.

21. The system of claim 16, wherein the presentation module is adapted to:

present the determined characteristic of the source to the user via an audible cue.

22. The system of claim 16, wherein the determined characteristic comprises a risk that the source is malicious.

23. A computer program product having a computer-readable medium having embodied thereon program code for informing a user of a computer system of a potential threat, the program code comprising:

a risk assessment module for identifying information regarding a source of a communication;

a local logic module for determining a characteristic of the source based on the identified information regarding the source and determining a score representing a threat assessment for the source responsive to the determined characteristic, wherein the determined characteristic comprises a reputation of the source and whether the source is a well-established entity; and

a presentation module for graphically presenting a representation of the score representing the threat assessment for the source to the user in association with the communication, wherein the representation comprises an icon indicating the reputation of the source and whether the source is a well-established entity, and wherein the icon is graphically presented in association with a program executing on the computer system and rendering the communication.

24. The computer program product of claim 23,

wherein the risk assessment module is adapted to parse the communication from the source to identify a link included in the communication and to identify information regarding the link'"'"'s source;

wherein the local logic module is adapted to determine a characteristic of the link'"'"'s source based on the identified information regarding the link'"'"'s source; and

wherein the presentation module is adapted to graphically present a representation of the determined characteristic of the link'"'"'s source to the user in association with the communication.

25. The computer program product of claim 23, wherein the source is executable code stored locally in the computer system.

26. The computer program product of claim 23, wherein the risk assessment module is adapted to:

communicate the identified information regarding the source to a server; and

receive the characteristic of the source from the server.

27. The computer program product of claim 23, wherein the program code further comprises:

a cache module for storing characteristic information of one or more sources; and

wherein the local logic module is adapted to determine the characteristic of the source based on the characteristic information stored in the cache module.

28. The computer program product of claim 23, wherein the determined characteristic comprises a risk that the source is malicious.